CVE-2026-86265 itsourcecode Sales and Inventory System us_transac.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-86265

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/us_transac.php , triggered by manipulation of the Username argument. The attack can be launched remotely and requires low privileges (authentication), with no user interaction needed. Per the CVS...

CVE-2026-86265 itsourcecode Sales and Inventory System us_transac.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...

EUVD-2026-72242

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-86264 sfturing ssm_pro Order Endpoint OrderController.java cross site scripting

A flaw has been found in sfturing ssmpro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName...

EUVD-2026-72240

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

EUVD-2026-72192

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-86245 itsourcecode Sales and Inventory System sup_transac.php sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...

CVE-2026-86244

FastAdmin up to 1.2.0.20210401_beta contains a cross-site scripting (XSS) vulnerability in the register/login function of application/index/controller/User.php (User Controller). Manipulating the url argument enables a remote attacker to execute arbitrary script in the user's browser, with a CVSS...

CVE-2026-86236

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/protransac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclose...

EUVD-2026-72183

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/postransac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may...

EUVD-2026-72181

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/usdel.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86236

itsourcecode Sales and Inventory System 1.0 is affected by a remote SQL injection in /pages/pro_transac.php?action=add, triggered by manipulation of the Name argument. The attack requires low privileges and no user interaction, with a CVSS 3.1 score of 6.3 (Medium) reflecting low impact on confid...

CVE-2026-86236 itsourcecode Sales and Inventory System pro_transac.php add sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/protransac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclose...

PT-2026-86668

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...

PT-2026-86627

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to...

CVE-2026-82756: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

PT-2026-86592

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2 Description A server-side request forgery exists in the UEditor component within the catchImage function of the backend/widgets/ueditor/Uploader.php file. A remote attacker can exploit this by manipulati...